| bc1ea6573c76663718d441f7b0b849a91f3eefbd |
|
13-Oct-2014 |
Neil Fuller <nfuller@google.com> |
Suppress failing OkHttp CTS tests
Added an additional regression test for SSLSocketTest.
Bug: 17962997
Bug: 17750026
Change-Id: Ic1171a916a8dbfe4f0ae486d650583de2547175b
|
| 6c9609af5f63a759bd50b5f6586f6f52502b4f93 |
|
07-Oct-2014 |
Neil Fuller <nfuller@google.com> |
Add support for TLS_FALLBACK_SCSV
Backport of commits:
external/conscrypt: 8d7e23e117da591a8d48e6bcda9ed6f58ff1a375
libcore: e6a6e935e98f426c7000b2bf4086f87101f4441c
libcore: 957ec8b09833e1c2f2c21380e53c13c9962e6b3e
Plus additional changes to:
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLServerSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/test/java/libcore/java/net/URLConnectionTest.java
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/CipherSuiteTest.java
support/src/test/java/libcore/java/security/StandardNames.java
to account for KitKat differences.
Bug: 17750026
Change-Id: Ic6e9474275bc3ffec3b5c2d6df1f8d6ffe77bff8
|
| 865c83f8383f03d545217c35d9140a4627a74406 |
|
07-Oct-2014 |
Neil Fuller <nfuller@google.com> |
Add support for TLS_FALLBACK_SCSV
Backport of commits:
external/conscrypt: 8d7e23e117da591a8d48e6bcda9ed6f58ff1a375
libcore: e6a6e935e98f426c7000b2bf4086f87101f4441c
libcore: 957ec8b09833e1c2f2c21380e53c13c9962e6b3e
Plus additional changes to:
luni/src/main/java/libcore/net/http/HttpConnection.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLServerSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/test/java/libcore/java/net/URLConnectionTest.java
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/CipherSuiteTest.java
support/src/test/java/libcore/java/security/StandardNames.java
to account for JellyBean differences.
Bug: 17750026
Change-Id: I7b60b1260fa0b275631ce9987168c7b5fc7ca138
|
| e6a6e935e98f426c7000b2bf4086f87101f4441c |
|
03-Oct-2014 |
Kenny Root <kroot@google.com> |
Add support for TLS_FALLBACK_SCSV
Bug: 17750026
Change-Id: I8dec89ae59a6f745f63120b11b4f6dbe9b21a139
|
| 36214feb86a0963b23f34c8c63584252bd757e19 |
|
17-Jun-2014 |
Brian Carlstrom <bdc@google.com> |
Remove
Change-Id: I143d0b26b116e75892223e74b6c22b6c8db05466
|
| 8d290a506a4a1cd1f86716719ee10586700468f4 |
|
17-Jun-2014 |
Brian Carlstrom <bdc@google.com> |
Remove
(cherry picked from commit 36214feb86a0963b23f34c8c63584252bd757e19)
Change-Id: I96d5109c01e39255b9970f7a515ddd3575a50e56
|
| ee109f62e99f43bcf8b78c857af430be9cf02985 |
|
19-Jun-2014 |
Alex Klyubin <klyubin@google.com> |
Assert that setEnabledProtocols/CipherSuites copy their inputs.
SSLSocket, SSLServerSocket, and SSLEngine offer setEnabledProtocols
and setEnabledCipherSuites methods which take an array of protocols
or cipher suites as input. If these methods store references to the
input arrays, then the internal state (lists of enabled protocols and
cipher suites) of SSLSocket, SSLServerSocket, and SSLEngine could be
modified without going through the setter methods of these classes.
Correct implementations of these methods should store copies of the
input arrays.
Bug: 15753142
Change-Id: Ia5248050d81320ed1da99892278bd60872605f52
|
| c9461f39290f815f560f2ec50e9ccde5ff4eb8f7 |
|
09-May-2014 |
Alex Klyubin <klyubin@google.com> |
Document and assert support for TLS-PSK cipher suites.
This CL updates the Javadoc of SSLSocket and SSLEngine to list the
now supported TLS-PSK cipher suites. It also adds tests to assert
that these cipher suites are actually supported by SSLSocket and
SSLEngine.
Bug: 15073623
Change-Id: I8e59264455f980f23a5e66099c27b5b4d932b9bb
|
| a660f1cceca91b728df45656b14321b56eb16fa5 |
|
08-May-2014 |
Kenny Root <kroot@google.com> |
SSLSocketTest: fix some flaky tests
Closing the server socket before SSL_do_handshake completed would
sometimes make SSL_do_handshake exit before it read the client's SSL
alert message.
Change-Id: I68bfb3d1908b055722678b7280ec4afe37a03ec8
|
| 3ad1704dc8e4653f4ceaeb5d8315ddb28318a1bb |
|
02-Apr-2014 |
Kenny Root <kroot@google.com> |
Update SSLEngineTest for RI
The RI now supports TLSv1.2 with SSLEngine, so update all the
expectations for their tests. It also appears to disable "weak"
algorithms when you select TLSv1.2.
Change-Id: I564283bb4945d3b71bee0f89c93c6dd6e238b4f8
|
| 70bf6bc3ad78ed9a0a7a5767381ad6c25debbd70 |
|
20-Mar-2014 |
Kenny Root <kroot@google.com> |
Add X509ExtendedTrustManager
This adds the X509ExtendedTrustManager class and all its ancillary
methods that allow it to be used. This allows the
endpointVerificationAlgorithm setting to be enabled on SSLSocket to
check that the cerificate given for the endpoint during the handshake
matched the expected hostname.
Since X509ExtendedTrustManager allows you to pass in an SSLSocket, there
is a new call added to SSLSocket called getHandshakeSession which does
not force the handshake to take place.
Bug: 13103812
Change-Id: I18a18b4f457d1676c8dc9a2a7bf7c3c4646a0425
|
| 4d8e05bc051c080e81f873a2d62b3c4867f485af |
|
21-Mar-2014 |
Kenny Root <kroot@google.com> |
SSLSocketText: alert during test should throw
The RI behavior was to throw an exception because of a fatal SSL alert
from the client. Our behavior was inconsistent since we had disabled
alerts during refactoring. We would still abort the connection, but not
in a nice way.
Change-Id: Ie7026d715d26b0eac5046907d64f2d4b3538cba8
|
| 7dd2dd04cdcf5150d6c993f72a1bad0e70308488 |
|
10-Mar-2014 |
Kenny Root <kroot@google.com> |
SSLSocketTest: test NPN/ALPN socket reuse
(cherry-picked from change 9f7c676c1937bdafce079cf02a67ac121296a335)
Bug: https://code.google.com/p/android/issues/detail?id=66562
Bug: 13396322
Change-Id: I9d8758d4b00cbf3ed332b8290cf48aacea01e00f
|
| 9f7c676c1937bdafce079cf02a67ac121296a335 |
|
10-Mar-2014 |
Kenny Root <kroot@google.com> |
SSLSocketTest: test NPN/ALPN socket reuse
Bug: https://code.google.com/p/android/issues/detail?id=66562
Change-Id: I393b281e3a67a621b51cb124c9275e664091d424
|
| 6ced3e6c746117d4145515a11762cff3de3c1fa9 |
|
26-Feb-2014 |
Kenny Root <kroot@google.com> |
SSLSocketTest: interrupt_read is too flaky
The interrupt test is very flaky currently, because there isn't a good
way to know when the thread we're waiting for is blocked in read. Try to
inspect the stack trace to see if one of the methods is "read" as an
attempt to make it less flaky.
Change-Id: I8503d645ffd5793f6e2fdc20692fbbb4d94cc37c
|
| 0007cf607af1bcc958b584242bb5d8d191ee22c4 |
|
18-Dec-2013 |
Alex Klyubin <klyubin@google.com> |
Test the length of ClientHello generated by SSLSocket.
Older/unpatched F5/BIG-IP appliances are known to stall/time out
TLS/SSL handshakes where ClientHello is contained in fragments which
are 256 to 511 (inclusive) bytes long.
Change-Id: I66eecbf56d4eeecdfdf63d8562f6079a356e474c
|
| 2cca77af136c57106bd9a1652e54a0ee99154d89 |
|
14-Dec-2013 |
Alex Klyubin <klyubin@google.com> |
Remove HarmonyJSSE SSLContext, SSLSocket and SSLServerSocket.
Change-Id: I3c939e9275ba8f1d00342d1f83c6fdaf110f2317
|
| 358552b505a8985ec9ed3691d0a6d590b60d620f |
|
25-Nov-2013 |
Alex Klyubin <klyubin@google.com> |
Assert that getEnabledCipherSuites/Protocols is affected by setters.
Change-Id: I806cfd4fd7f8be39c9bfcce956f6c2804e917c26
|
| bccd4e67d528d52d368e4bbd319621ba2cc15e5f |
|
25-Nov-2013 |
Alex Klyubin <klyubin@google.com> |
No need to sanity-check client certs in SSLSocket.accept.
This CL adjusts the SSLSocketTest to follow the RI and not
sanity-check client certs early during SSLSocket.accept.
The change in the code under test (external/conscrypt) was made in
https://android-review.googlesource.com/#/c/70467/
Change-Id: I93fde2f5520109b97ae81fd4752b3bd0f67a1a19
|
| f605c6822da13b32cd3643415a707882b62a3e91 |
|
06-Nov-2013 |
Alex Klyubin <klyubin@google.com> |
Higher-level default configuration asserts for TLS/SSL primitives.
This adds SSLDefaultConfigurationAsserts class that offers
higher-level checks for each TLS/SSL primitive. The goals are:
* check not only the cipher suites and protocols configured but also
the configuration of child primitives (e.g, configuration of
SSLSockets returned by SSLSocketFactory, or configuration of
SSLSocketFactory returned by SSLContext).
* hide the upcoming target API level dependent configuration checks
from test classes.
Bug: 11220570
Change-Id: Iec1476a1b2d132c984413754129adfcb671885fb
|
| a784bce5655435d8641f7d384c8da3fab018c491 |
|
08-Nov-2013 |
Kenny Root <kroot@google.com> |
SSLSocketTest: use SSLSocket instead of SSLEngine
This test was meant to use TestSSLSocketPair, but it might have been
copied from the similar SSLEngineTest.
Change-Id: I975e4661e819a218a65505397619e84ff72b6671
|
| 038cb91ddb127750737055649f6171dc1af3985a |
|
06-Nov-2013 |
Alex Klyubin <klyubin@google.com> |
BEAST attack mitigation for OpenSSL-backed SSLSockets.
This adjusts SSLSocketTest to deal with 1/n-1 record splitting
introduced as mitigation against BEAST.
Bug: 11514124
Change-Id: I3fef273edd417c51c5723d290656d2e03331d68a
|
| f13911b39126ffae49737dadc74332b3a84e0d19 |
|
04-Nov-2013 |
Alex Klyubin <klyubin@google.com> |
Exact asserts for TLS/SSL protocols used by default.
Previously, assertions about the list of protocols used by default by
TLS/SSL primitives were checking that all of the protocols are
supported, but were not checking that the list was exactly as
expected. This CL adjusts the assertions to check that all of the
expected protocols are listed and that no other protocols are listed.
Three assert methods are added, corresponding to the three
concentually different lists: client-side (e.g., SSLSocket),
server-side (SSLServerSocket), and SSLEngine which currently does not
switch lists based on whether it's in client or server mode.
Bug: 11220570
Change-Id: Ib6b56c2372d76f94f254481aa01d29d2d03a085f
|
| 3086b42a3032dab9c1cd1dd9f92ce3763870cfa3 |
|
01-Nov-2013 |
Alex Klyubin <klyubin@google.com> |
Exact assert for cipher suite list used by default by SSLSocket.
Previously, assertions about the default list of cipher suites used
by SSLSocket and SSLContext were checking that all of the cipher
suites are supported, but were not checking that the list was exactly
as expected. This CL adjusts the assertions to check that all of the
expected cipher suites are listed in the expected order and that no
other cipher suites are listed.
Bug: 11220570
Change-Id: I92c811d6ca4cfab1eb3b44061ce94bed1d82920e
|
| 2cd541f61919798b5b050c210f61db450ad8b013 |
|
30-Oct-2013 |
Alex Klyubin <klyubin@google.com> |
Refactor TLS/SSL cipher suite and protocol assertions.
This hides expected lists of cipher suites and protocols from the
users of assertion methods to:
* enable targetSdkVersion-dependent behavior, and
* centralize the definition of expected behavior in StandardNames.
Bug: 11220570
Change-Id: I8b43196b24f02e10010223aa6738a9ce0df24333
|
| d255af15f749d98cf06fe72fdf46ccf3988f10d2 |
|
21-Oct-2013 |
Narayan Kamath <narayan@google.com> |
Resurrect test_SSLSocket_interrupt_case.
Fixed by change 68360.
Change-Id: Iaa5d10d173a95d890fd2e0744def185ea1012a22
|
| 36f1c15a1cb2e66b8852ea51f7a82c4ccc9ac886 |
|
10-Sep-2013 |
Brian Carlstrom <bdc@google.com> |
Fixed interruption of blocked SSLSocket via Socket.close()
Bug: 10599593
(cherry picked from commit 3f17b9a79c4331504f32d34ce46adf7a78870f87)
Change-Id: I1bffa8189d64aa8ee0aa1ac414359aecb71934a5
|
| 3f17b9a79c4331504f32d34ce46adf7a78870f87 |
|
10-Sep-2013 |
Brian Carlstrom <bdc@google.com> |
Fixed interruption of blocked SSLSocket via Socket.close()
Bug: 10599593
Change-Id: Iade24eed691756281dfd925abe57740a1ad4145b
|
| 5b748b7bd848dea8bf8099f5b40081640ad6b1b9 |
|
03-Sep-2013 |
Brian Carlstrom <bdc@google.com> |
Increase wait time for test_SSLSocket_interrupt_case
Bug: 10599593
(cherry picked from commit a96049c03db95fd46583ac917f221791cf7d08dc)
Change-Id: Ifd5cfe1134a246671da0d1729b635b1f091ea3c6
|
| a96049c03db95fd46583ac917f221791cf7d08dc |
|
03-Sep-2013 |
Brian Carlstrom <bdc@google.com> |
Increase wait time for test_SSLSocket_interrupt_case
Bug: 10599593
Change-Id: I941c43692499c6b3e970df943a0a766121d100e0
|
| 70b79a2cc89dd2845582001cd3f2a8cf8301ce6c |
|
03-May-2013 |
Kenny Root <kroot@google.com> |
Replace mentions of old JSSE package name
Change-Id: I7c90b08ee2b43c73e02512d0c6caaec098967e93
|
| ee41931d976501d0fb4516bd43919b9564558619 |
|
30-Apr-2013 |
Kenny Root <kroot@google.com> |
Fix mentions of JSSE
Change-Id: I248f6010b363922366b665153f9844b219bfde81
|
| 5911a70a882d502d21b74dcdca6d9f4fcd5e36d5 |
|
06-Apr-2013 |
Brian Carlstrom <bdc@google.com> |
Don't forget to call sessionRemoved from removeEldestEntry
Also to prevent similar problems in the future, remember SSLSession we
are trying to use in case it disappears from SSLSessionContext.
Added test of SSLSocket SSLSession reuse.
Bug: https://code.google.com/p/android/issues/detail?id=52738
Bug: 8313208
(cherry picked from commit b88ab0efb05475fa9d4e2a06175e95e88f507cff)
Change-Id: I229e018c3acb427a7b580eaf880f86d9b263bac7
|
| b88ab0efb05475fa9d4e2a06175e95e88f507cff |
|
06-Apr-2013 |
Brian Carlstrom <bdc@google.com> |
Don't forget to call sessionRemoved from removeEldestEntry
Also to prevent similar problems in the future, remember SSLSession we
are trying to use in case it disappears from SSLSessionContext.
Added test of SSLSocket SSLSession reuse.
Bug: https://code.google.com/p/android/issues/detail?id=52738
Bug: 8313208
Change-Id: I30824cdf96a0d1086abccb61c011dbc9ad60f8cf
|
| 283a5d1ff99659815a3fae78b9eab2ce856a908a |
|
17-Mar-2013 |
Brian Carlstrom <bdc@google.com> |
Fix for test_SSLSocket_HandshakeCompletedListener_RuntimeException
While this test worked fine from the dalvik command line, it failed
when run as part of the frameworks test runner which overrides the
default UncaughtExceptionHandler to do more than log.
Bug: 8272842
Change-Id: I09d53863b901148cada8852cd46c3e88e372ac90
|
| 51cf1b49bca54ec0229a51df400ad1bee580b1bb |
|
16-Mar-2013 |
Brian Carlstrom <bdc@google.com> |
Assorted socket fixes related to test_SSLSocket_setSoWriteTimeout failure investigation
1.) Fixed the failure of libcore.javax.net.ssl.SSLSocketTest's
test_SSLSocket_setSoWriteTimeout by setting send/recv buffer sizes earlier (b/8272932)
2.) Fixed javadoc bug in java.net.Socket
3.) Fixed implementation bug in IoBridge affecting reading SO_RCVBUF
4.) Fixed bug where we would leave unsent bytes in OpenSSL write buffer after SSLSocket write
possible cause of b/6693087
Bug: 8272932
Bug: 6693087
Change-Id: I54e084e58e8b10583a6ac3051d5e05e519139d64
|
| 1f1dc0af2c01f2a2b6cf4907ecb21b4e05982e2b |
|
18-Jan-2013 |
Kenny Root <kroot@google.com> |
SSLSocketTest: Run through all providers after error
Previously an error would cause the SSLSocketTest to terminate
prematurely. This change make sure it runs through all intended
combinations.
Change-Id: Id7d08c83b3449f204be8c3511a8a4e989e744084
|
| 39d69d058be0c1a4555aeed4a237c2af05ae39c6 |
|
18-Jan-2013 |
Brian Carlstrom <bdc@google.com> |
Make test_SSLSocket_getSupportedCipherSuites_connect continue to next supported cipher suite on exception
Change-Id: I251c96bd033fa14a01880df20eba7f7626bfccb3
|
| 8c4a407e34de1b348316a9175bd1c0577c887181 |
|
09-Jan-2013 |
Brian Carlstrom <bdc@google.com> |
verifyCertificateChain should convert unknown exceptions to CertificateException
Bug: http://code.google.com/p/android/issues/detail?id=42533
Change-Id: Id0e0eb8f007987decb4fee94135be8a92d2f8981
|
| 615225a35dbd838210270b282d1196deff643b51 |
|
22-Sep-2012 |
Brian Carlstrom <bdc@google.com> |
Add OpenSSLSocketImpl.setSoWriteTimeout to allow SO_SNDTIMEO to be specified
Bug: 6693087
Change-Id: Ie6903168ca0ada4516c55dfab5f7194baf965b4c
|
| 783004cceef470884b3ee6946cbbfc4af0f28ae7 |
|
20-Aug-2012 |
Brian Carlstrom <bdc@google.com> |
Restore ability for SSLSocket.close() to interrupt reads and writes
SSLSocketTest.test_SSLSocket_interrupt didn't catch this regression so
added new test_SSLSocket_interrupt_read to cover this case
specifically. Also cleanup SSLSocketTest to use Executors like
NativeCryptoTest instead of Threads for better error checking.
Bug: 7014266
Change-Id: I1160cd283310a0c6197cd3271a25830e0e2b1524
|
| fc1332710b0af3bbe658535a257048cf8c7577f2 |
|
24-Jul-2012 |
Brian Carlstrom <bdc@google.com> |
Fix flakey test_SSLSocket_setSoTimeout_basic by using a full second timeout
Change-Id: I5b7d57f012dcef0047cf292f311ee3fa49700414
|
| aba5e8c281fb9c6be23229246473fa0b433dd997 |
|
25-May-2011 |
Brian Carlstrom <bdc@google.com> |
OpenSSLSocketImpl should tolerate X509KeyManager returning null values
While this started out as the small fix in
OpenSSLSocketImpl.setCertificate and the corresponding test
test_SSLSocket_clientAuth_bogusAlias, the need to test the behavior of
the X509KeyManager returning null on the RI led to test maintenance to
get libcore.javax.net.ssl tests working on RI 7 thanks to a test
dependency that was added on the new InetAddress.getLoopbackAddress().
Change-Id: I3d8ed1ce453cc3a0b53e23e39c02e6a71413649c
|
| 101547d4a82ba21031dc7cb62018720dbd493758 |
|
01-Feb-2011 |
Jesse Wilson <jessewilson@google.com> |
Refactoring to add a builder for TestKeyStore.
Change-Id: I346aea42a27042512f4ed97690f1e0ca1755257c
|
| 54ac4a62e86b216842a79f433d0919ac19c0ee54 |
|
31-Jan-2011 |
Brian Carlstrom <bdc@google.com> |
Remove duplicate copy of test_SSLSocket_shutdownCloseOnClosedPeer from automerge
git cherry-pick -e 9c6855d6d6cbf59678a7b18e3ec7b40434517bca
Change-Id: Icb164396fd3685e981d71f860f7edbde874128a6
|
| 6cf293f679defc7322ca63ffac2c8f2d3dba81aa |
|
31-Jan-2011 |
Brian Carlstrom <bdc@google.com> |
Remove duplicate copy of test_SSLSocket_shutdownCloseOnClosedPeer from automerge - do not merge
Change-Id: I1648069637280a6f22cddb0b4906e4acf2f903f7
|
| 9c6855d6d6cbf59678a7b18e3ec7b40434517bca |
|
31-Jan-2011 |
Brian Carlstrom <bdc@google.com> |
Remove duplicate copy of test_SSLSocket_shutdownCloseOnClosedPeer from automerge
Change-Id: Iff213a489b4ff4c0e2d2d8dec86840eddd21439b
|
| aa2be6b82cdf3bb292076d2a614a5f5b40e63123 |
|
24-Jan-2011 |
Brian Carlstrom <bdc@google.com> |
SSLSocket.close() should not throw an IOException if there is a problem sending a close notify
Bug: 3405962
Bug: 3350645
git cherry-pick -e 1c64b3adb85345659ac60ad82216268acba18764
|
| 1c64b3adb85345659ac60ad82216268acba18764 |
|
24-Jan-2011 |
Brian Carlstrom <bdc@google.com> |
SSLSocket.close() should not throw an IOException if there is a problem sending a close notify
Bug: 3350645
Change-Id: I23844fc94a26175247538c95d8cddec90f368d64
|
| 0d5c7588179fb373da70ce04362be5ce74a98eb4 |
|
24-Jan-2011 |
Brian Carlstrom <bdc@google.com> |
Cipher.init incorrectly implements RFC 3280 key usage validation
Issue: http://code.google.com/p/android/issues/detail?id=12955
Bug: 3381582
Change-Id: Ida63c1356634c8e287ce5b0234418a656dffedf0
|
| a3d357bd346336f7ff304a9a26c81e93f67f98e6 |
|
23-Dec-2010 |
Brian Carlstrom <bdc@google.com> |
Fix CloseGuard warning in a test merged in from gingerbread
Change-Id: Idfc64fbf6363335874b8fa11e00b2fe3074e78a1
|
| 2915378e253f08e47fe5a9bfd026cd1ca7c6c351 |
|
16-Dec-2010 |
Brian Carlstrom <bdc@google.com> |
HttpsURLConnection retry should not invoke X509TrustManager and HostnameVerifier more than once
Summary:
In 2.3, HttpsURLConnection was change to retry TLS connections as SSL
connections w/o compression to deal with servers that are TLS
intolerant. However, if the handshake proceeded to the point of
invoking the X509TrustManager, we should not retry. Similarly, if we
should not invoke the HostnameVerifier repeatedly, and need to wait
until the SSL handshake has completed.
Tested with (includes two new tests for this issue):
libcore/luni/src/test/java/libcore/javax/net/ssl/
libcore/luni/src/test/java/libcore/java/net/URLConnectionTest.java
libcore/luni/src/test/java/org/apache/harmony/luni/tests/internal/net/www/protocol/https/HttpsURLConnectionTest.java
Details:
HttpConnection.setupSecureSocket has been broken into two
pieces. setupSecureSocket now just does the SSL
handshaking. verifySecureSocketHostname now does the
verification. The old HttpConnection code was careful never to
assign its sslSocket field until verification was complete. A new
unverifiedSocket field is added to store the sslSocket before
verification is completed by verifySecureSocketHostname.
luni/src/main/java/org/apache/harmony/luni/internal/net/www/protocol/http/HttpConnection.java
HttpsEngine.makeConnection now skips TLS intolerant retry if the
reason for the makeSslConnection failure was a
CertificateException, since that implies that we failed during
certification validation after initial handshaking. We also
prevent retrying hostname verification by moving it out of
makeSslConnection and only doing it on new SSL connections,
tracking the changes to HttpConnection.setupSecureSocket mentioned
above. We also now skip the redundant call to setUpTransportIO in
makeSslConnection on reused SSLSockets.
luni/src/main/java/org/apache/harmony/luni/internal/net/www/protocol/https/HttpsURLConnectionImpl.java
Instead of throwing away the underlying CertificateExceptions, set
them as the cause of the SSLExceptions. This is what the RI does
in the case of X509TrustManager failures and is now used by
HttpsEngine.makeConnection.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSessionImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Added new testConnectViaHttpsToUntrustedServer which makes sure
that connections are not retried on certificate verification
failure.
luni/src/test/java/libcore/java/net/URLConnectionTest.java
Added new test_SSLSocket_untrustedServer that verifies that an
SSLHandshakeException is thown containing a CertificateException
is thrown on certificate verification problems.
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
Added second test CA and a new TestKeyStore.getClientCA2 test key
store that does not trust the primary test key stores. This is
useful for negative testing and is used in the above two new
tests.
support/src/test/java/libcore/java/security/TestKeyStore.java
Issue: http://code.google.com/p/android/issues/detail?id=13178
Bug: 3292412
Change-Id: I37136bb65f04d2bceaf2f32f542d6432c8b76ad4
|
| ffeba5dd766602f6e2be9caa9081744348a53c04 |
|
01-Dec-2010 |
Brian Carlstrom <bdc@google.com> |
Add support for TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher suite
"TLS_EMPTY_RENEGOTIATION_INFO_SCSV" is RFC 5746's renegotiation
indication signaling cipher suite value. It is not a real cipher
suite. It is just an indication in the default and supported cipher
suite lists indicates that the implementation supports secure
renegotiation.
In the RI, its presence means that the SCSV is sent in the cipher
suite list to indicate secure renegotiation support and its absence
means to send an empty TLS renegotiation info extension instead.
However, OpenSSL doesn't provide an API to give this level of control,
instead always sending the SCSV and always including the empty
renegotiation info if TLS is used (as opposed to SSL). So we simply
allow TLS_EMPTY_RENEGOTIATION_INFO_SCSV to be passed for compatibility
as to provide the hint that we support secure renegotiation.
Change-Id: I0850bea47568edcfb1f7df99d4e8a747f938406d
|
| 4ae3fd787741bfe1b808f447dcb0785250024119 |
|
19-Nov-2010 |
Brian Carlstrom <bdc@google.com> |
Elliptic Crypto support for OpenSSLSocketImpl
Summary:
- Enable Elliptic Crypto support for OpenSSL based SSLSocket instances
- More RI compliant usage of key types, client auth types, and server auth types
- Steps toward TLS_EMPTY_RENEGOTIATION_INFO_SCSV support, currently test updates
Details:
Elliptic Curve changes
CipherSuite updates for EC
- Adding KEY_EXCHANGE_EC* and corresponding CipherSuites Updated
isAnonymous, getKeyType (now renamed getServerKeyType) to handle
new EC cases. Added new getAuthType for use by
checkServerTrusted callers.
- Restructured code to handle two SUITES_BY_CODE_* arrays
- Remove KEY_EXCHANGE_DH_* definitions which unused because the
corresponding CipherSuites were previously disabled.
- Changed AES CipherSuites definitions to use "_CBC" to match other definitions.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
openssl EC
- NativeCrypto now registers TLS_EC_* cipher suites and has update default list
- Improved auth type arguments to checkClientTrusted/checkServerTrusted
- NativeCrypto support for emphemeral EC keys
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/main/native/NativeCrypto.cpp
non-openssl SSL/TLS cleanups
- cleanup around code trying to cope with DiffieHellman vs DH since either should work.
- changed client to use new CipherSuite.getAuthType shared with NativeCrypto implementation
- changed server to use CipherSuite.getKeyType
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ClientHandshakeImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/HandshakeProtocol.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/KeyManagerImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ServerHandshakeImpl.java
Consolidate CertificateRequestType code into CipherSuite so that its
shared between java and openssl implementations. This includes the
KEY_TYPE_ string constants, TLS_CT_* byte constants and the 'String
keyType(byte)' (now renamed getClientKeyType) code that depends on them.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CertificateRequest.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ClientHandshakeImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLServerSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ServerHandshakeImpl.java
Tests
Differentiate between supported list of cipher suites openssl-based
SSLSocket and SSLEngine based, since the SSLEngine code does not support EC.
luni/src/test/java/libcore/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
Added testing for expected default cipher suites. Before we just ensured the values were valid.
luni/src/test/java/libcore/javax/net/ssl/SSLSocketFactoryTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Updated to handle new EC cipher suites codes. Added test for new getClientKeyType.
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/CipherSuiteTest.java
Better use of "standard names" particularly to correctly deal with
the subtle differences between key types, client auth types, and
server auth types. TestKeyManager and TestTrustManager now verify
the values they are passed are acceptable.
support/src/test/java/libcore/java/security/StandardNames.java
support/src/test/java/libcore/javax/net/ssl/TestKeyManager.java
support/src/test/java/libcore/javax/net/ssl/TestTrustManager.java
Changed to timeout after 30 seconds and to log to reveal both client and server issues.
support/src/test/java/libcore/javax/net/ssl/TestSSLSocketPair.java
Bug: 3058375
Change-Id: I14d1d0285d591c99cc211324f3595a5be682cab1
|
| 6c78b7b94c232063ec559436b48b33751373ecf1 |
|
19-Nov-2010 |
Brian Carlstrom <bdc@google.com> |
Toward EC TLS support
Summary:
- javax.net.ssl tests are now working on the RI
- KeyManager can now handle EC_EC and EC_RSA
- OpenSSLSocketImpl.startHandshake now works if KeyManager contains EC certificates
Details:
Add CipherSuite.getKeyType to provide X509KeyManager key type strings,
refactored from OpenSSLServerSocketImpl.checkEnabledCipherSuites.
getKeyType is now also used in OpenSSLSocketImpl.startHandshake to
avoid calling setCertificate for unnecessary key types.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLServerSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
New CipherSuiteTest to cover new getKeyType as well as existing functionality
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/CipherSuiteTest.java
Add support to KeyManager implementation for key types of the form
EC_EC and EC_RSA. The first part implies the KeyPair algorithm (EC in
these new key types) with a potentially different signature algorithm
(EC vs RSA in these)
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/KeyManagerImpl.java
Update NativeCrypto.keyType to support EC_EC and EC_RSA in addition to
EC which was added earlier. Change from array of KEY_TYPES to named
KEY_TYPE_* constants.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
Overhauled KeyManagerFactoryTest to cover EC, EC_EC, EC_RSA cases
luni/src/test/java/libcore/javax/net/ssl/KeyManagerFactoryTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Changed TestKeyStore.createKeyStore from always using BKS to now use
JKS on the RI between BC EC Keys and RI X509 certificates. Because JKS
requires a password, we now default "password" on the RI.
support/src/test/java/libcore/java/security/TestKeyStore.java
luni/src/test/java/libcore/javax/net/ssl/SSLContextTest.java
support/src/test/java/libcore/java/security/StandardNames.java
TestKeyStore.create now accepts key types like EC_RSA. Changed
TestKeyStore.createKeys to allow a PrivateKeyEntry to be specified for
signing to enable creation of EC_RSA test certificate. Added
getRootCertificate/rootCertificate to allow lookup of PrivateKeyEntry
for signing. Changed TestKeyStore.getPrivateKey to take explicit
signature algorithm to retrieve EC_EC vs EC_RSA entries.
support/src/test/java/libcore/java/security/TestKeyStore.java
luni/src/test/java/libcore/java/security/KeyStoreTest.java
luni/src/test/java/libcore/javax/net/ssl/KeyManagerFactoryTest.java
luni/src/test/java/libcore/java/security/cert/PKIXParametersTest.java
luni/src/test/java/libcore/javax/net/ssl/TrustManagerFactoryTest.java
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Added support for EC cipher suites on the RI. Also test with and
without new TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher suite which is
used to specify the new TLS secure renegotiation.
luni/src/test/java/libcore/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
support/src/test/java/libcore/java/security/StandardNames.java
New TestKeyManager and additional logging in TestTrustManager. Logging
in both is disabled by default using DevNullPrintStream.
support/src/test/java/libcore/javax/net/ssl/TestKeyManager.java
support/src/test/java/libcore/javax/net/ssl/TestTrustManager.java
support/src/test/java/libcore/java/io/DevNullPrintStream.java
Bug: 3058375
Change-Id: Ia5e2a00a025858e10d1076b900886994b481e05a
|
| a5c608e59f9d574ea4bc65e9dff44aae2f34fd26 |
|
01-Nov-2010 |
Brian Carlstrom <bdc@google.com> |
TrustManager improvements
Overhaul of TrustManagerImpl
- PKIXParameters can now be final in TrustManagerImpl because we
always immediately create an IndexedPKIXParameters instead of only
doing it in SSLParametersImpl.createDefaultTrustManager.
- Use new KeyStore constructor for IndexedPKIXParameters to remove
duplicate logic for creating set of TrustAnchors from a KeyStore.
- Improved checkTrusted/cleanupCertChain to remove special cases for
directly trusting the end cert or pruning only self signed certs. To
support b/2530852, we need to stop prune the chain as soon as we
find any trust anchor (using newly improved
TrustManagerImpl.isTrustAnchor), which could be at the beginning,
middle, or end. That means cleanupCertChain can return an empty
chain if everything was trusted directly. (and we don't need to do
extra checks on exception cases to see if the problem was just that
the trust anchor was in the chain)
- isDirectlyTrusted -> isTrustAnchor here as well, using new
IndexedPKIXParameters.isTrustAnchor APIs
- Fix incorrect assumption in getAcceptedIssuers that all TrustAnchor
instances have non-null results for getTrustedCert.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java
Removed indexing in createDefaultTrustManager since we always index now
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/SSLParametersImpl.java
Overhaul of IndexedPKIXParameters
- Single map from subject X500Principal to TrustAnchors
instead of two different X500Principal keyed maps to check
- Removed map based on encoded cert. For b/2530852, we want to treat
certs as equal if they have the same name and public key, not
byte-for-byte equality, which can be done with the remaining map.
Revamped isDirectlyTrusted into isTrustAnchor(cert) to perform this
new name/key based comparison.
- Added helper isTrustAnchor(cert, anchors) to reuse code in
non-IndexedPKIXParameters case in TrustManagerImpl.
- Added constructor from KeyStore
- Moved anchor indexing code to index() from old constructor
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/IndexedPKIXParameters.java
TestKeyStore.getPrivateKey allowed some existing test simplification.
luni/src/test/java/libcore/java/security/KeyStoreTest.java
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
support/src/test/java/libcore/java/security/TestKeyStore.java
Added missing "fail()" before catching expected exceptions.
luni/src/test/java/libcore/java/security/KeyStoreTest.java
Expanded KeyManagerFactoryTest to excercise ManagerFactoryParameters b/1628001
luni/src/test/java/libcore/javax/net/ssl/KeyManagerFactoryTest.java
Added KeyStoreBuilderParametersTest because I thought I saw a bug in
KeyStoreBuilderParameters, but this convinced me otherwise.
luni/src/test/java/libcore/javax/net/ssl/KeyStoreBuilderParametersTest.java
New TrustManagerFactory test modeled on expanded KeyManagerFactoryTest.
test_TrustManagerFactory_intermediate specifically is targeting the
new functionality of b/2530852 to handling trust anchors within the
chain.
luni/src/test/java/libcore/javax/net/ssl/TrustManagerFactoryTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Some initial on tests for Elliptic Curve (b/3058375) after the RI
started reporting it was supported. Removed old @KnownFailure
tags. Skipped a test on the RI that it can't handle. Improved some
assert messages.
luni/src/test/java/libcore/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
support/src/test/java/libcore/java/security/StandardNames.java
support/src/test/java/libcore/java/security/TestKeyStore.java
Removed unneeded bytes->javax->bytes->java case of which can just go bytes->java directly.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Removed super()
luni/src/main/java/javax/net/ssl/KeyStoreBuilderParameters.java
Made Security.secprops final
luni/src/main/java/java/security/Security.java
Pulled SamplingProfiler fix from dalvik-dev branch
git cherry-pick --no-commit f9dc3450e8f23cab91efc9df99bb860221ac3d6c
dalvik/src/main/java/dalvik/system/SamplingProfiler.java
Bug: 2530852
Change-Id: I95e0c7ee6a2f66b6986b3a9da9583d1ae52f94dd
|
| f7aab022dcbfcd8f27b409ab92b4bca4a84d0b8a |
|
30-Sep-2010 |
Brian Carlstrom <bdc@google.com> |
CloseGuard: finalizers for closeable objects should log complaints
Introducing CloseGuard which warns when resources are implictly
cleaned up by finalizers when an explicit termination method, to use
the Effective Java "Issue 7: Avoid finalizers" terminology, should
have been used by the caller.
libcore classes that can use CloseGuard now do so.
Bug: 3041575
Change-Id: I4a4e3554addaf3075c823feb0a0ff0ad1c1f6196
|
| 84f161268b8ae93a9046c40ca8381aa92148f2f6 |
|
21-Sep-2010 |
Brian Carlstrom <bdc@google.com> |
Make SSL network I/O interruptible
- Changed NativeCrypto code to hold onto java.io.FileDescriptor so it
can see observe when another thread calls Socket.close and sets the
FileDescriptor's fd to -1. Changed AppData::setEnv to check
NetFd::isClosed, it was already being used before each SSL I/O
operation.
- Changed sslSelect to no longer take an int fd, it now uses the
AppData to get access the FileDescriptor. Within sslSelect, the
select call is now protected with AsynchronousSocketCloseMonitor.
The select call is now retried on EINTR, checking for socket close
similar to NET_FAILURE_RETRY. sslSelect now returns
THROWN_SOCKETEXCEPTION to indicate that NetFd::isClosed has already
thrown.
- sslRead and sslWrite now similarly returns THROWN_SOCKETEXCEPTION to
indicate that Net::isClosed detected a closed FileDescriptor.
luni/src/main/native/NativeCrypto.cpp
Moved NetFd from OSNetworkSystem.cpp to new NetFd.h for reuse by NativeCrypto
luni/src/main/native/NetFd.h
luni/src/main/native/org_apache_harmony_luni_platform_OSNetworkSystem.cpp
Added test of 4 Socket/SSLSocket interrupt cases
1.) read Socket / close Socket (redundant with AsynchronousCloseExceptionTest)
2.) read Socket / close SSLSocket
3.) read SSLSocket / close Socket
4.) read SSLSocket / close SSLSocket
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
Bug: 2973020
Change-Id: I9037738dd1d1c09c03c99e3403e086366aa25109
|
| a4a95792af235d4bf3256eab3208f74fae8ec262 |
|
19-Sep-2010 |
Brian Carlstrom <bdc@google.com> |
SSLSocket should respect timeout of a wrapped Socket
Change to using getSoTimeout in OpenSSLSocketImpl instead of directly
using the timeout field. This means the proper timeout will be used
for instances of the OpenSSLSocketImplWrapper subclass, which is used
when an SSLSocket is wrapped around an existing connected non-SSL
Socket. The code still maintains the local timeout field, now renamed
timeoutMilliseconds, which is now accesed via
OpenSSLSocketImpl.getSoTimeout. Doing so prevents a getsockopt syscall
that otherwise would be necessary if the super.getSoTimeout() was used.
Added two unit tests for testing timeouts with SSLSockets wrapped
around Socket. One is simply for getters/setters. The second makes
sure the timeout is functioning when set on the underlying socket.
Bug: 2973305
Change-Id: Idac52853f5d777fae5060a840eefbfe85d448e4c
|
| 5f2e6872311240319509aed64d9f58cd5b64719b |
|
23-Aug-2010 |
Brian Carlstrom <bdc@google.com> |
SSLSocket.read should throw SocketException not NullPointerException
OpenSSLSocketImpl now uses checkOpen similar to Socket's
checkOpenAndCreate to ensure that SocketExceptions are thrown if
certain operations are tried after the socket is closed.
Also added *_setUseClientMode_afterHandshake tests for SSLSocket and
SSLEngine. We properly through IllegalArgument exception in this case,
but it wasn't covered by the tests previously.
Bug: 2918499
Change-Id: I393ad39bed40a33725d2c0f3f08b9d0b0d3ff85f
|
| 4557728efb66c455a52b7669a8eefef7a9e54854 |
|
11-Aug-2010 |
Jesse Wilson <jessewilson@google.com> |
Moving tests to be under the libcore.* package.
This is indended to make it easier to run on VMs that restrict the packages
from which application classes can be loaded. For example, on the RI you need
to use the bootclasspath to load these tests.
Change-Id: I52193f35c5fcca18b5a3e1d280505b1e29b388af
|